mbox series

[v2,bpf-next,0/8] Support BTF-powered BPF tracing programs for kernel modules

Message ID 20201201035545.3013177-1-andrii@kernel.org
Headers show
Series Support BTF-powered BPF tracing programs for kernel modules | expand

Message

Andrii Nakryiko Dec. 1, 2020, 3:55 a.m. UTC
Building on top of two previous patch sets ([0] and not yet landed [1]), this
patch sets extends kernel and libbpf with support for attaching BTF-powered
raw tracepoint (tp_btf) and tracing (fentry/fexit/fmod_ret/lsm) BPF programs
to BPF hooks defined in kernel modules.

Kernel UAPI for BPF_PROG_LOAD is extended with extra parameter
(attach_btf_obj_id) which allows to specify kernel module BTF in which the BTF
type is identifed by attach_btf_id.

Comments

Yonghong Song Dec. 1, 2020, 7:26 a.m. UTC | #1
On 11/30/20 7:55 PM, Andrii Nakryiko wrote:
> Building on top of two previous patch sets ([0] and not yet landed [1]), this
> patch sets extends kernel and libbpf with support for attaching BTF-powered
> raw tracepoint (tp_btf) and tracing (fentry/fexit/fmod_ret/lsm) BPF programs
> to BPF hooks defined in kernel modules.
> 
> Kernel UAPI for BPF_PROG_LOAD is extended with extra parameter
> (attach_btf_obj_id) which allows to specify kernel module BTF in which the BTF
> type is identifed by attach_btf_id.
> 
>  From end user perspective there are no extra actions that need to happen.
> Libbpf will continue searching across all kernel module BTFs, if desired
> attach BTF type is not found in vmlinux. That way it doesn't matter if BPF
> hook that user is trying to attach to is built-in into vmlinux image or is
> loaded in kernel module.
> 
> Currently pahole doesn't generate BTF_KIND_FUNC info for ftrace-able static
> functions in kernel modules, so expose traced function in bpf_sidecar.ko. Once

bpf_sidecar.ko => bpf_testmod.ko

> pahole is enhanced, we can go back to static function.
> 
>    [0] https://patchwork.kernel.org/project/netdevbpf/list/?series=380759&state=*
>    [1] https://patchwork.kernel.org/project/netdevbpf/list/?series=393677&state=*
> 
> v1->v2:
>    - avoid increasing bpf_reg_state by reordering fields (Alexei);
>    - preserve btf_data_size in struct module;
>    - rebase on top of v3 of patch [1].
> 
> Andrii Nakryiko (8):
>    bpf: keep module's btf_data_size intact after load
>    bpf: remove hard-coded btf_vmlinux assumption from BPF verifier
>    bpf: allow to specify kernel module BTFs when attaching BPF programs
>    libbpf: factor out low-level BPF program loading helper
>    libbpf: support attachment of BPF tracing programs to kernel modules
>    selftests/bpf: add tp_btf CO-RE reloc test for modules
>    selftests/bpf: make bpf_testmod's traceable function global
>    selftests/bpf: add fentry/fexit/fmod_ret selftest for kernel module
> 
>   include/linux/bpf.h                           |  13 +-
>   include/linux/bpf_verifier.h                  |  28 +++-
>   include/linux/btf.h                           |   7 +-
>   include/uapi/linux/bpf.h                      |   1 +
>   kernel/bpf/btf.c                              |  90 +++++++----
>   kernel/bpf/syscall.c                          |  44 +++++-
>   kernel/bpf/verifier.c                         |  77 ++++++----
>   kernel/module.c                               |   1 -
>   net/ipv4/bpf_tcp_ca.c                         |   3 +-
>   tools/include/uapi/linux/bpf.h                |   1 +
>   tools/lib/bpf/bpf.c                           | 101 ++++++++----
>   tools/lib/bpf/libbpf.c                        | 145 +++++++++++++-----
>   tools/lib/bpf/libbpf_internal.h               |  30 ++++
>   .../selftests/bpf/bpf_testmod/bpf_testmod.c   |   3 +-
>   .../selftests/bpf/prog_tests/core_reloc.c     |   3 +-
>   .../selftests/bpf/prog_tests/module_attach.c  |  53 +++++++
>   .../bpf/progs/test_core_reloc_module.c        |  32 +++-
>   .../selftests/bpf/progs/test_module_attach.c  |  66 ++++++++
>   18 files changed, 546 insertions(+), 152 deletions(-)
>   create mode 100644 tools/testing/selftests/bpf/prog_tests/module_attach.c
>   create mode 100644 tools/testing/selftests/bpf/progs/test_module_attach.c
>
Andrii Nakryiko Dec. 1, 2020, 9:50 p.m. UTC | #2
On Mon, Nov 30, 2020 at 11:26 PM Yonghong Song <yhs@fb.com> wrote:
>
>
>
> On 11/30/20 7:55 PM, Andrii Nakryiko wrote:
> > Building on top of two previous patch sets ([0] and not yet landed [1]), this
> > patch sets extends kernel and libbpf with support for attaching BTF-powered
> > raw tracepoint (tp_btf) and tracing (fentry/fexit/fmod_ret/lsm) BPF programs
> > to BPF hooks defined in kernel modules.
> >
> > Kernel UAPI for BPF_PROG_LOAD is extended with extra parameter
> > (attach_btf_obj_id) which allows to specify kernel module BTF in which the BTF
> > type is identifed by attach_btf_id.
> >
> >  From end user perspective there are no extra actions that need to happen.
> > Libbpf will continue searching across all kernel module BTFs, if desired
> > attach BTF type is not found in vmlinux. That way it doesn't matter if BPF
> > hook that user is trying to attach to is built-in into vmlinux image or is
> > loaded in kernel module.
> >
> > Currently pahole doesn't generate BTF_KIND_FUNC info for ftrace-able static
> > functions in kernel modules, so expose traced function in bpf_sidecar.ko. Once
>
> bpf_sidecar.ko => bpf_testmod.ko
>

will fix, thanks!

> > pahole is enhanced, we can go back to static function.
> >
> >    [0] https://patchwork.kernel.org/project/netdevbpf/list/?series=380759&state=*
> >    [1] https://patchwork.kernel.org/project/netdevbpf/list/?series=393677&state=*
> >
> > v1->v2:
> >    - avoid increasing bpf_reg_state by reordering fields (Alexei);
> >    - preserve btf_data_size in struct module;
> >    - rebase on top of v3 of patch [1].
> >
> > Andrii Nakryiko (8):
> >    bpf: keep module's btf_data_size intact after load
> >    bpf: remove hard-coded btf_vmlinux assumption from BPF verifier
> >    bpf: allow to specify kernel module BTFs when attaching BPF programs
> >    libbpf: factor out low-level BPF program loading helper
> >    libbpf: support attachment of BPF tracing programs to kernel modules
> >    selftests/bpf: add tp_btf CO-RE reloc test for modules
> >    selftests/bpf: make bpf_testmod's traceable function global
> >    selftests/bpf: add fentry/fexit/fmod_ret selftest for kernel module
> >
> >   include/linux/bpf.h                           |  13 +-
> >   include/linux/bpf_verifier.h                  |  28 +++-
> >   include/linux/btf.h                           |   7 +-
> >   include/uapi/linux/bpf.h                      |   1 +
> >   kernel/bpf/btf.c                              |  90 +++++++----
> >   kernel/bpf/syscall.c                          |  44 +++++-
> >   kernel/bpf/verifier.c                         |  77 ++++++----
> >   kernel/module.c                               |   1 -
> >   net/ipv4/bpf_tcp_ca.c                         |   3 +-
> >   tools/include/uapi/linux/bpf.h                |   1 +
> >   tools/lib/bpf/bpf.c                           | 101 ++++++++----
> >   tools/lib/bpf/libbpf.c                        | 145 +++++++++++++-----
> >   tools/lib/bpf/libbpf_internal.h               |  30 ++++
> >   .../selftests/bpf/bpf_testmod/bpf_testmod.c   |   3 +-
> >   .../selftests/bpf/prog_tests/core_reloc.c     |   3 +-
> >   .../selftests/bpf/prog_tests/module_attach.c  |  53 +++++++
> >   .../bpf/progs/test_core_reloc_module.c        |  32 +++-
> >   .../selftests/bpf/progs/test_module_attach.c  |  66 ++++++++
> >   18 files changed, 546 insertions(+), 152 deletions(-)
> >   create mode 100644 tools/testing/selftests/bpf/prog_tests/module_attach.c
> >   create mode 100644 tools/testing/selftests/bpf/progs/test_module_attach.c
> >